Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
5 Oct 2020
3 Sep 2020
How to fix?
There is no fixed version for
node-pdf-generator is a Web server to generate PDF's from HTML
Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF). Due to lack of user input validation and sanitization done to the content given to
node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.
git clone https://github.com/darrenhaken/node-pdf-generator.git
The app will be available at https://localhost:1337
send crafted request like:
curl --location --request POST 'https://127.0.0.1:1337/' --header 'Content-Type: text/html' --data-raw ''